11 charged in TJX identity theft

— -- Federal authorities think they may have their men in one of the biggest known cybercrimes ever.

The U.S. Justice Department on Tuesday said it charged 11 people in the theft of millions of credit and debit card numbers of customers for nine major U.S. retailers, including TJX, the parent company of T.J. Maxx, Marshalls and other stores.

The massive computer data breach at TJX may have affected 94 million Visa and MasterCard accounts — nearly double the previous estimate by the retailer — according to court filings last year.

The charges name three people from the USA, three from the Ukraine, two from China, one from Belarus and one from Estonia. The final individual is known only by an alias online.

The ring was spearheaded by a Miami man named Albert "Segvec" Gonzalez, 27, who hacked into the computer networks of retailers including TJX, BJ's Wholesale Club, OfficeMax, Boston Market, Barnes & Noble, Sports Authority, Forever 21, DSW and Dave & Buster's, the Justice Department said.

The stolen information was allegedly stored on computer servers in the USA and Eastern Europe, and sold via the Internet to other criminals. The stolen numbers were "cashed out" by encoding card numbers on the magnetic strips of blank cards that were used to withdraw tens of thousands of dollars from ATMs, authorities said. The money was allegedly laundered through banks in Eastern Europe.

Gonzalez, who is being held by New York authorities on another hacking charge, was charged with computer fraud, wire fraud, access-device fraud, aggravated identity theft and conspiracy, authorities said. He faces life in prison if convicted of all charges.

In a statement, TJX thanked law enforcement and said more cooperation with banks and credit card companies is needed to fight fraud.

The TJX digital break-in has been the whopper among a series of breaches in recent years that have bedeviled companies and vexed customers.

Until Tuesday's charges, no one had been arrested for breaking into TJX's computer systems. Six people were convicted in Florida last year for their roles in a ring that used stolen TJX customer data to buy gift cards and goods worth at least $1 million.